/**
 * Environment-driven configuration for VINES.
 *
 * Variables (see `vines/spec.md` §5):
 *
 *   MARIADB_URL       mariadb://host[:port]/database. Do NOT embed a password
 *                     here — the URL is stored in plaintext config, so a
 *                     password in it would leak. Set MARIADB_USER below and
 *                     supply MARIADB_PASSWORD via the gateway environment.
 *   MARIADB_USER      database user
 *   MARIADB_PASSWORD  password (from the gateway env / a 0600 EnvironmentFile)
 *   MARIADB_SSL       'disabled' | 'preferred' | 'required'
 *                     default 'preferred'. TLS modes always verify the server
 *                     certificate; use a CA-trusted cert or an SSH tunnel for
 *                     databases that present a self-signed cert.
 *   LINEAR_API_KEY    Linear personal API token (required for any Linear call)
 */
export type SslMode = "disabled" | "preferred" | "required";
export interface DBConfig {
    host: string;
    port: number;
    user: string;
    password: string;
    database: string;
    sslMode: SslMode;
}
/**
 * Parse the DB env vars into a {@link DBConfig}. Throws a clear, fixable
 * error on missing or malformed input.
 */
export declare function loadDBConfig(env?: NodeJS.ProcessEnv): DBConfig;
/**
 * Translate {@link SslMode} into the `ssl` option of the `mariadb` driver.
 *  - disabled  → no TLS (returns false; driver connects plaintext)
 *  - preferred → TLS with server-certificate verification
 *  - required  → TLS with server-certificate verification (same as preferred
 *                for this driver; the server-side `REQUIRE SSL` enforces it)
 *
 * Every TLS mode verifies the server certificate (`rejectUnauthorized: true`).
 * There is intentionally no mode that disables verification: for a database
 * that presents a self-signed certificate, use a CA-trusted cert or tunnel the
 * connection over SSH instead (see SECURITY.md).
 */
export declare function sslOptionFor(mode: SslMode): boolean | {
    rejectUnauthorized: boolean;
};
/**
 * Attach the MariaDB `password` field onto an existing connection / pool
 * config object. The mariadb driver reads this field at connect / createPool
 * time. The value is an env-sourced credential, never a literal.
 */
export declare function attachDbCredential<T extends object>(target: T, password: string): T;
export declare function loadLinearApiKey(env?: NodeJS.ProcessEnv): string;
//# sourceMappingURL=config.d.ts.map